Retrieve the domain names that resolved to an IP during a time frame. You can narrow results with record_types (A or AAAA).

Results are aggregated per domain name and multiple distinct ranges for a name will be grouped into one row of results. For example, if censys.com resolved to 1.1.1.1 from January 1 to January 7 during two different ranges of January 1 to January 3 and January 5 to January 7, and you targeted January 1 through January 7 with your API call, then this endpoint will group those ranges into one entry for censys.com in the response.

To retrieve domain names for an IP with each record broken down by time range, use the ranges endpoint

In a SOC environment, use this endpoint to find every domain that has pointed at a malicious IP, with first- and last-seen bounds per name, so you can discover related domains and block them.

This endpoint is only available to organizations on the Censys Search and Censys Core plans.

Learn more about Censys Active DNS.